AZ-204 Risk Assessment & Management 5 — Questions and Answers
Question 1: You are designing an Azure solution where multiple microservices share a single Azure SQL database. What risk does this architecture introduce and what is the recommended mitigation?
- Network latency risk; mitigate with Azure ExpressRoute
- Schema coupling and shared fate risk; mitigate by giving each service its own schema or database (Correct answer)
- Cost risk; mitigate with reserved capacity pricing
- Backup risk; mitigate with geo-redundant backups
Correct answer: Schema coupling and shared fate risk; mitigate by giving each service its own schema or database
Sharing a database couples microservices through the schema, and a bad migration or load spike from one service can impact all others; separate schemas or databases enforce service boundaries.
Question 2: A security audit finds that your Azure Container Registry allows anonymous pull access. What is the immediate risk and correct remediation?
- Risk: increased egress costs; remediation: enable geo-replication
- Risk: unauthorized access to proprietary container images; remediation: disable anonymous pull and enforce Entra ID authentication (Correct answer)
- Risk: slower pull times; remediation: enable Premium tier caching
- Risk: image corruption; remediation: enable content trust
Correct answer: Risk: unauthorized access to proprietary container images; remediation: disable anonymous pull and enforce Entra ID authentication
Anonymous pull allows any unauthenticated user on the internet to pull your container images, exposing proprietary code; disabling it and requiring Entra ID authentication prevents unauthorized access.
Question 3: When using Azure Application Insights to assess application health risk, which metric best indicates that the application is approaching a memory exhaustion condition?
- Dependency duration (ms)
- Process private bytes / performanceCounters/processPrivateBytes (Correct answer)
- Request rate (requests/sec)
- Server response time (ms)
Correct answer: Process private bytes / performanceCounters/processPrivateBytes
The performanceCounters/processPrivateBytes metric tracks the private memory allocated to the process, and a steadily increasing trend indicates a potential memory leak.
Question 4: Your organization requires that all Azure resource deployments adhere to approved configurations (e.g., no public IP addresses on VMs). Which Azure service enforces this policy risk control continuously?
- Azure Blueprints (one-time assignment only)
- Azure Policy with Deny and DeployIfNotExists effects (Correct answer)
- Azure Resource Locks
- Azure Cost Management budgets
Correct answer: Azure Policy with Deny and DeployIfNotExists effects
Azure Policy continuously evaluates resources against defined rules; the Deny effect prevents non-compliant deployments and DeployIfNotExists can auto-remediate missing configurations.
Question 5: A Cosmos DB container uses the default indexing policy. What risk does this introduce for a write-heavy workload?
- No risk; default indexing uses minimal RU/s
- Higher RU consumption per write because all properties are indexed by default (Correct answer)
- Queries will fail without a custom index
- Automatic indexing increases storage but does not affect RU/s
Correct answer: Higher RU consumption per write because all properties are indexed by default
The default Cosmos DB indexing policy indexes all properties, consuming additional RU/s on every write operation; for write-heavy workloads, a custom policy excluding unnecessary paths reduces this cost and latency risk.
Question 6: You need to ensure that a compromised Azure Function cannot escalate privileges to access other Azure resources beyond its intended scope. Which control enforces this?
- Assign the Function's managed identity only the specific RBAC roles it needs, scoped to the minimum resource (Correct answer)
- Enable Azure Defender for App Service on the Function App
- Rotate the Function App's host key every 30 days
- Place the Function App inside a Virtual Network
Correct answer: Assign the Function's managed identity only the specific RBAC roles it needs, scoped to the minimum resource
Scoping the managed identity to the minimum required RBAC roles on specific resources limits the blast radius if the Function is compromised, preventing privilege escalation to other resources.
Question 7: During a risk review, it's found that an Azure Logic App makes HTTP calls to an external webhook without validating the response. Which defensive coding practice should be added?
- Increase the Logic App timeout to 120 seconds
- Add a response schema validation action and configure error handling branches for non-2xx status codes (Correct answer)
- Switch the Logic App to consumption tier for auto-scaling
- Enable run history retention for 90 days
Correct answer: Add a response schema validation action and configure error handling branches for non-2xx status codes
Validating the webhook response schema and handling non-2xx status codes explicitly prevents the Logic App from silently accepting malformed or error responses as successful operations.
AZ-204 Risk Assessment & Management 5
You are designing an Azure solution where multiple microservices share a single Azure SQL database.
What risk does this architecture introduce and what is the recommended mitigation?